Filterlog config changes

2025-12-21 16:33:08 +01:00 · 2020-10-09 23:56:52 +00:00
parent 930ec33cb7
commit 69a04dedd3
4 changed files with 85 additions and 33 deletions
--- a/salt/elasticsearch/files/ingest/syslog
+++ b/salt/elasticsearch/files/ingest/syslog
@@ -12,6 +12,9 @@
                "ignore_failure": true
        }
    },
+    { "grok":           { "field": "message",       "patterns": ["<%{INT:syslog.priority}>%{DATA:syslog.timestamp} %{WORD:source.application}: %{GREEDYDATA:real_message}"], "ignore_failure": false } },
+    { "set": { "if": "ctx.source.application == 'filterlog'", "field": "dataset", "value": "firewall" } },
+    { "pipeline": { "if": "ctx.dataset == 'firewall'", "name": "filterlog" } },
    { "pipeline":       { "name": "common"                                             } }
  ]
 }